Date: Fri, 25 Jun 2021 20:46:59 GMT From: Dave Cottlehuber <dch@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: ac3da0e9b976 - main - security/vuxml: add entry for net/rabbitmq-c Message-ID: <202106252046.15PKkx2b053899@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by dch: URL: https://cgit.FreeBSD.org/ports/commit/?id=ac3da0e9b9766f2a2e45824519b54f21b9af7112 commit ac3da0e9b9766f2a2e45824519b54f21b9af7112 Author: Dave Cottlehuber <dch@FreeBSD.org> AuthorDate: 2021-06-25 20:44:16 +0000 Commit: Dave Cottlehuber <dch@FreeBSD.org> CommitDate: 2021-06-25 20:46:55 +0000 security/vuxml: add entry for net/rabbitmq-c Sponsored by: SkunkWerks, GmbH Security: CVE-2019-18609 Differential Revision: https://reviews.freebsd.org/D30906 --- security/vuxml/vuln-2021.xml | 35 +++++++++++++++++++++++++++++++---- 1 file changed, 31 insertions(+), 4 deletions(-) diff --git a/security/vuxml/vuln-2021.xml b/security/vuxml/vuln-2021.xml index d0c9bef7dbfd..55a391078e51 100644 --- a/security/vuxml/vuln-2021.xml +++ b/security/vuxml/vuln-2021.xml @@ -1,3 +1,34 @@ + <vuln vid="7c555ce3-658d-4589-83dd-4b6a31c5d610"> + <topic>RabbitMQ-C -- integer overflow leads to heap corruption</topic> + <affects> + <package> + <name>net/rabbitmq-c</name> + <name>net/rabbitmq-c-devel</name> + <range><lt>0.10.0</lt></range> + </package> + <p>alanxz reports:</p> + <blockquote cite="https://github.com/alanxz/rabbitmq-c/commit/fc85be7123050b91b054e45b91c78d3241a5047a">; + <p>When parsing a frame header, validate that the frame_size is less than + or equal to INT32_MAX. Given frame_max is limited between 0 and + INT32_MAX in amqp_login and friends, this does not change the API. + This prevents a potential buffer overflow when a malicious client sends + a frame_size that is close to UINT32_MAX, in which causes an overflow + when computing state->target_size resulting in a small value there. A + buffer is then allocated with the small amount, then memcopy copies the + frame_size writing to memory beyond the end of the buffer.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2019-18609</cvename> + <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18609</url>; + </references> + <dates> + <discovery>2019-10-29</discovery> + <entry>2021-06-25</entry> + </dates> + </vuln> + <vuln vid="41bc849f-d5ef-11eb-ae37-589cfc007716"> <topic>PuppetDB -- SQL Injection</topic> <affects> @@ -8,7 +39,6 @@ <package> <name>puppetdb7</name> <range><lt>7.4.1</lt></range> - </package> </affects> <description> <body xmlns="http://www.w3.org/1999/xhtml">; @@ -25,9 +55,6 @@ </references> <dates> <discovery>2021-06-24</discovery> - <entry>2021-06-25</entry> - </dates> - </vuln> <vuln vid="4c9159ea-d4c9-11eb-aeee-8c164582fbac"> <topic>Ansible -- Templating engine bug</topic>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202106252046.15PKkx2b053899>